CVE-2026-48811

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.221, FreeScout allows a non-admin user to permanently delete an internal note (private thread) from any conversation, even after that user's access to the mailbox containing the conversation has been revoked. The ThreadPolicy::delete authorization policy does not verify mailbox membership, so a former team member retains destructive write access to notes they created. This vulnerability is fixed in 1.8.221.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-9vx8-gx3p-9mh6
https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-9vx8-gx3p-9mh6

Configurations

No configuration.

History

No history.

Information

Published : 2026-05-29 20:16

Updated : 2026-07-22 06:10

NVD link : CVE-2026-48811

Mitre link : CVE-2026-48811

CVE.ORG link : CVE-2026-48811

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-48811", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48811", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-01T15:15:00.790272Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "freescout-help-desk", "product": "freescout", "versions": [{"status": "affected", "version": "< 1.8.221"}]}]}], "published": "2026-05-29T20:16:29.233", "references": [{"url": "https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-9vx8-gx3p-9mh6", "source": "security-advisories@github.com"}, {"url": "https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-9vx8-gx3p-9mh6", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.221, FreeScout allows a non-admin user to permanently delete an internal note (private thread) from any conversation, even after that user's access to the mailbox containing the conversation has been revoked. The ThreadPolicy::delete authorization policy does not verify mailbox membership, so a former team member retains destructive write access to notes they created. This vulnerability is fixed in 1.8.221."}, {"lang": "es", "value": "FreeScout es una mesa de ayuda gratuita y una bandeja de entrada compartida construido con el framework Laravel de PHP. Previo a la 1.8.221, FreeScout permite a un usuario no administrador eliminar permanentemente una nota interna (hilo privado) de cualquier conversaci\u00f3n, incluso despu\u00e9s de que el acceso de ese usuario al buz\u00f3n que contiene la conversaci\u00f3n haya sido revocado. La pol\u00edtica de autorizaci\u00f3n ThreadPolicy::delete no verifica la pertenencia al buz\u00f3n, por lo que un antiguo miembro del equipo retiene acceso de escritura destructivo a las notas que cre\u00f3. Esta vulnerabilidad est\u00e1 corregida en la 1.8.221."}], "lastModified": "2026-07-22T06:10:00.170", "sourceIdentifier": "security-advisories@github.com"}